Aggregator

A senior government source said China is 'playing the long game' by targeting private schools, adding that the country is 'doing all the things we used to do as an empire'.

Northumbria Police were called to reports of a serious assault on Whiteleas Way roundabout in South Shields just before 3.30pm on Saturday.

The killer nurse is reportedly being checked on every 15 minutes by staff at HMP Bronzefield as part of an enforced Assessment, Care in Custody and Teamwork (ACCT) order.

All lines between two stations were closed

The women-only dating-advice app Tea "has been hit with 10 potential class action lawsuits in federal and state court," NBC News reported last week, "after a data breach led to the leak of thousands of selfies, ID photos and private conversations online." The suits could result in Tea having to pay tens of millions of dollars in damages to the plaintiffs, which could be catastrophic for the company, an expert told NBC News... One of the suits lists the right-wing online discussion board 4chan and the social platform X as defendants, alleging that they allowed bad actors to spread users' personal information. But meanwhile, a new competing app for men called "TeaOnHer" has already been launched. And it was also found to have enormous security flaws, reports TechCrunch, that "exposed its users' personal information, including photos of their driver's licenses and other government-issued identity documents..." [W]hen we looked at the TeaOnHer's public internet records, it had no meaningful information other than a single subdomain, appserver.teaonher.com. When we opened this page in our browser, what loaded was the landing page for TeaOnHer's API (for the curious, we uploaded a copy here)... It was on this landing page that we found the exposed email address and plaintext password (which wasn't that far off from "password") for [TeaOnHer developer Xavier] Lampkin's account to access the TeaOnHer "admin panel"... This API landing page included an endpoint called /docs, which contained the API's auto-generated documentation (powered by a product called Swagger UI) that contained the full list of commands that can be performed on the API [including administrator commands to return user data]... While it's not uncommon for developers to publish their API documentation, the problem here was that some API requests could be made without any authentication — no passwords or credentials were needed... The records returned from TeaOnHer's server contained users' unique identifiers within the app (essentially a string of random letters and numbers), their public profile screen name, and self-reported age and location, along with their private email address. The records also included web address links containing photos of the users' driver's licenses and corresponding selfies. Worse, these photos of driver's licenses, government-issued IDs, and selfies were stored in an Amazon-hosted S3 cloud server set as publicly accessible to anyone with their web addresses. This public setting lets anyone with a link to someone's identity documents open the files from anywhere with no restrictions... The bugs were so easy to find that it would be sheer luck if nobody malicious found them before we did. We asked, but Lampkin would not say if he has the technical ability, such as logs, to determine if anyone had used (or misused) the API at any time to gain access to users' verification documents, such as by scraping web addresses from the API. In the days since our report to Lampkin, the API landing page has been taken down, along with its documentation page, and it now displays only the state of the server that the TeaOnHer API is running on as "healthy." The flaws were discovered while TeaOnHer was the #2 free app in the Apple App Store, the article points out. And while these flaws "appear to be resolved," the article notes a larger issue. "Shoddy coding and security flaws highlight the ongoing privacy risks inherent in requiring users to submit sensitive information to use apps and websites," And TeaOnHer also had another authentication issue. A female reporter at Cosmopolitan also noted Friday that TeaOnHer "lets you browse through profiles before your verifications are complete. So literally anyone (like myself) can read reviews..."

Read more of this story at Slashdot.

Adam Collard broke down into tears as he spoke about his fianceé Laura Woods' miscarriage on Sunday's episode of Celeb SAS.

The real lesson here is how little some companies care about training

Who, Me?  Welcome to Monday and another instalment of Who, Me? It’s The Register’s reader-contributed column in which you admit to mistakes and reveal if they derailed your career.…

Brits wake to a beeping nightmare as Amazon’s AI assistant forgets how to set – or stop – alarms

Amazon's Alexa is on the fritz, bungling alarms and timers and leaving some UK users trapped in an endless wake-up call.…

One lane is closed on the A12 both ways between Junction 29, A120 Crown Interchange, and Junction 28, Colchester JobServe Stadium.

Elena Di Liddo, 31, who has represented Italy on competed in the 2020 Tokyo summer Olympics, took to Instagram to lament her frustrations earlier this week.

Police patrols will be stepped up in the area following the death

Dr Sohom Das is a forensic psychiatrist, from London, has revealed two subtle signs that somebody may be a psychopath.

Just over a month ahead of the royal wedding, Meghan Markle joined Prince Harry to meet youth delegates taking part in the Commonwealth Heads of Government Meeting (CHOGM) in London.

Essex firefighters scrambled to deal with the building on fire in West Avenue, when they were called to the scene just after midnight.

People nearby were told to shut their doors and windows

If you wanted to hurt Putin’s ransomware racketeers, these info-stealing npm packages are one way to do it

Researchers at software supply chain security outfit Safety think they’ve found malware that targets Russian cryptocurrency developers, and perhaps therefore Russia’s state-linked ransomware crews…

The Princess of Wales has mastered the art of dressing to impress - but she's equally admired for her relaxed, countryside style, often showcased during rural engagements.

Effortlessly elegant socialite Beatrice Borromeo, who is celebrating her 40th birthday today, was once crowned 'most stylish European royal' by Tatler.

Blockbuster weight loss jabs relied on by millions not be the quick fix many believe it to be, experts warn, as users pil on the pounds after stopping treatment.

For months, everything at Yusuf's company was fine. Then, suddenly, he comes in to the office to learn that overnight the log exploded with thousands of panic messages. No software changes had been pushed, no major configurations had happened- just a reboot. What had gone wrong?

This particular function was invoked as part of the application startup:

func (a *App) setupDocDBClient(ctx context.Context) error { docdbClient, err := docdb.NewClient( ctx, a.config.MongoConfig.URI, a.config.MongoConfig.Database, a.config.MongoConfig.EnableTLS, ) if err != nil { return nil } a.DocDBClient = docdbClient return nil }

This is Go, which passes errors as part of the return. You can see an example where docdb.NewClient returns a client and an err object. At one point in the history of this function, it did the same thing- if connecting to the database failed, it returned an error.

But a few months earlier, an engineer changed it to swallow the error- if an error occurred, it would return nil.

As an organization, they did code reviews. Multiple people looked at this and signed off- or, more likely, multiple people clicked a button to say they'd looked at it, but hadn't.

Most of the time, there weren't any connection issues. But sometimes there were. One reboot had a flaky moment with connecting, and the error was ignored. Later on in execution, downstream modules started failing, which eventually led to a log full of panic level messages.

The change was part of a commit tagged merely: "Refactoring". Something got factored, good and hard, all right.

[Advertisement] Picking up NuGet is easy. Getting good at it takes time. Download our guide to learn the best practice of NuGet for the Enterprise.